tcp out of order that cause packet loss

[asda]

device   : 300C 

There were some packets had been lossed.I found a tip that explain how it happed.

When the the 3rd tcp handshake packet ('ack') get handle by CPU (slow path), the 1st data would already get accelerate by Network Processor (fast path) and will increase possibility to trigger TCP out of order between these 2 packets.

Under what circumstances will  packets be processed by the CPU instead of being accelerated by the network processor?

Will it happen when the network processor accelerates to full load? Can you please tell me the specifications for network processor acceleration? Because my device is too old, it is NP4, and the command

config firewall polic

    edit <>

        set delay-tcp-npu-session enable

does not support it

Is there any other solution to alleviate packet loss?

Please tell me,thank you very much.

[AEK]

Hi Asda

As per my knowledge (not exhaustive), the CPU will handle the packets in these cases:

• 1st packet of the session
• if you explicitly disable NPU offloading
• on interfaces that are not connected to NPU (e.g.: HA port, mgmt port, small FG models)
• other cases where the NPU is not designed for the session specs

In case you suspect this symptom, you can try disable NPU offload in the affected policy and see if it helps.

config firewall policy
 edit X
  set auto-asic-offload disable
 end

[asda]

Hi AEK

Thank for your advice.I will try this method.

And do you know that NPU is enabled by default?

And is there any commons that will show how much NPU used, just like

 get sys perfo status

will show how did CPU used.

Thank you very much.

[AEK]

Hi Asda

Yes NPU offloading is enabled by default.

This command set for NPU6 info & statistics should help:

https://docs.fortinet.com/document/fortigate/7.4.3/hardware-acceleration/591936/get-hardware-npu-np6

[asda]

Thank you very much